4,948 results · Feed
-
Critical max 8.6ALAS2-2023-2318 7 CVEs
Critical: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-46847: Due to a buffer overflow bug Squid is vulnerable to a Denial of Service attack against HTTP Digest Authentication CVE-2021-28116: Squid through 4.14 and 5…
first Oct 25, 2023 -
Critical max 8.6ALAS2023-2023-402 1 CVE
Critical: squid security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-46847: Due to a buffer overflow bug Squid is vulnerable to a Denial of Service attack against HTTP Digest Authentication
first Oct 25, 2023 -
Low max 7.5ALAS2023-2023-428 1 CVE
Low: jackson-databind security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2021-46877: jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage …
first Oct 30, 2023 -
Medium max 7.8ALAS2023-2023-425 1 CVE
Moderate: binutils security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-1579: A potential illegal memory access in binutils has been found when parsing a corrupt file.
first Oct 30, 2023 -
High max 7.4ALAS2023-2023-423 2 CVEs
Important: open-vm-tools security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-34059: open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able t…
first Oct 30, 2023 -
High max 8.1ALAS2023-2023-421 1 CVE
Important: plexus-archiver security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-37460: Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArchiver` API. …
first Oct 30, 2023 -
High max 8.1
Important: ecs-service-connect-agent security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-44487: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited …
first Oct 30, 2023 -
High max 7.5ALAS2023-2023-419 1 CVE
Important: cni-plugins security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-39325: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited …
first Oct 30, 2023 -
High max 7.5ALAS2023-2023-418 1 CVE
Important: oci-add-hooks security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-39325: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited …
first Oct 30, 2023 -
Medium max 6.6ALAS2023-2023-417 3 CVEs
Moderate: opensc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-4535: Out-of-bounds read in MyEID driver handling encryption using symmetric keys This issue require physical access to the computer running opensc and crafte…
first Oct 30, 2023 -
High max 9.1ALAS2023-2023-416 2 CVEs
Important: samba security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-4091: SMB client can truncate files to 0 bytes by opening files with OVERWRITE disposition when using the acl_xattr Samba VFS module with the smb.conf setting…
first Oct 30, 2023 -
High max 5.3ALAS2023-2023-415 2 CVEs
Important: tomcat9 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-45648: Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 throu…
first Oct 30, 2023 -
LowALAS2023-2023-414 1 CVE
Low: vorbis-tools security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-43361: Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conver…
first Oct 30, 2023 -
MediumALAS2023-2023-413 1 CVE
Moderate: libvpx security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-44488: VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding.
first Oct 30, 2023 -
High max 5.3ALAS2023-2023-412 3 CVEs
Important: nodejs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-45143: Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin re…
first Oct 30, 2023 -
HighALAS2023-2023-411 1 CVE
Important: libxml2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-45322: libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: …
first Oct 30, 2023 -
Medium max 8.8ALAS2023-2023-410 1 CVE
Moderate: zlib security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-45853: MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, o…
first Oct 30, 2023 -
High max 7.5ALAS2023-2023-409 2 CVEs
Important: grub2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-4693: An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafte…
first Oct 30, 2023 -
Low max 7.5ALAS2023-2023-407 1 CVE
Low: glibc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-5156: A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application cra…
first Oct 30, 2023 -
High max 7.5ALAS2023-2023-406 1 CVE
Important: openssl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-5363: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns during the …
first Oct 30, 2023 -
Medium max 5.3ALAS2023-2023-405 1 CVE
Moderate: wireshark security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-5371: RTPS dissector memory leak in Wireshark 4.0.0 to 4.0.8 and 3.6.0 to 3.6.16 allows denial of service via packet injection or crafted capture file
first Oct 30, 2023 -
High max 7.8ALAS2023-2023-404 2 CVEs
Important: xorg-x11-server security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-5380: A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup wi…
first Oct 30, 2023 -
Low max 7.8ALAS2023-2023-403 2 CVEs
Low: vim security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-5535: Use After Free in GitHub repository vim/vim prior to v9.0.2010. CVE-2023-5441: NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace3…
first Oct 30, 2023 -
LowALAS2-2023-2333 1 CVE
Low: nmap security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-15173: Nmap through 7.70, when the -sV option is used, allows remote attackers to cause a denial of service (stack consumption and application crash) via a craft…
first Oct 30, 2023 -
Medium max 6.7ALAS2-2023-2332 7 CVEs
Moderate: libguestfs-winsupport security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-30789: A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G through 2021.8.22. CVE-2022-30788: A crafted NTFS im…
first Oct 30, 2023 -
Medium max 5.5ALAS2-2023-2331 1 CVE
Moderate: nautilus security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-37290: GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.
first Oct 30, 2023 -
HighALAS2-2023-2330 1 CVE
Important: python security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-48565: An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to…
first Oct 30, 2023 -
High max 7.4ALAS2-2023-2329 2 CVEs
Important: open-vm-tools security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-34059: open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to h…
first Oct 30, 2023 -
High max 8.2ALAS2-2023-2327 1 CVE
Important: xerces-c security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-37536: An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.
first Oct 30, 2023 -
High max 7.5ALAS2-2023-2326 1 CVE
Important: golist security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-39325: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in …
first Oct 30, 2023 -
High max 7.5ALAS2-2023-2325 1 CVE
Important: cni-plugins security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-39325: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in …
first Oct 30, 2023 -
High max 7.5ALAS2-2023-2324 1 CVE
Important: cri-tools security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-39325: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in …
first Oct 30, 2023 -
Medium max 6.6ALAS2-2023-2323 2 CVEs
Moderate: opensc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-40661: multiple memory issues with pkcs15-init (enrollment tool) CVE-2023-40660: Potential PIN bypass. When the token/card was plugged into the computer and auth…
first Oct 30, 2023 -
HighALAS2-2023-2322 3 CVEs
Important: httpd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-45802: Description A flaw was found in mod_http2. When a HTTP/2 stream is reset (RST frame) by a client, there is a time window were the request's memory resourc…
first Oct 30, 2023 -
HighALAS2-2023-2321 1 CVE
Important: libxml2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-45322: libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the…
first Oct 30, 2023 -
Medium max 8.8ALAS2-2023-2320 1 CVE
Moderate: zlib security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-45853: MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or e…
first Oct 30, 2023 -
Low max 7.8ALAS2-2023-2319 2 CVEs
Low: vim security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-5535: Use After Free in GitHub repository vim/vim prior to v9.0.2010. CVE-2023-5441: NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e…
first Oct 30, 2023 -
High max 9.8ALAS2-2023-2303 7 CVEs
Important: amazon-ssm-agent security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-3978: Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. …
first Oct 12, 2023 -
HighALAS2-2023-2254 2 CVEs
Important: libjpeg-turbo security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-29390: libjpeg-turbo version 2.0.90 has a heap-based buffer over-read (2 bytes) in decompress_smooth_data in jdcoefct.c. CVE-2020-17541: Libjpeg-turbo all versio…
first Sep 13, 2023 -
HighALAS2-2022-1872 3 CVEs
Important: libtiff security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-2869: A flaw was found in libtiff's tiffcrop tool that has a uint32_t underflow, which leads to an out-of-bounds read and write in the extractContigSamples8bits …
first Oct 31, 2022